Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
100 detections
Filters
Last updated
All Time
Detection languages
42
29
16
5
3
Contributors
18
16
9
9
8
Categories
47
43
21
18
12
Platforms
50
22
19
14
9
Products / Services
15
14
12
12
12
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
4
3
3
3
3
IDS Classtypes
11
2
1
1
1
IDS Protocols
11
5
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects potential token-replay persistence by identifying repeated 'MailItemsAccessed' events for the same user account from a non-native 'REST' and 'Firefox' client string, recurring at consistent ~30-minute intervals.
Detects exploit attempts targeting the authentication bypass vulnerability in Dahua NetKeyboard devices (CVE-2021-33044) by monitoring HTTP requests containing malicious 'global.login' RPC parameters.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.
Detects unauthenticated WordPress administrator account takeover attempts targeting the User Profile Builder plugin. The rule identifies inbound HTTP GET requests containing the 'autologin=true' parameter and a forged '_wpnonce' value matching the 'autologin-1-' pattern, which exploits an authentication bypass vulnerability (CVE-2026-15826) to gain unauthorized session access as user ID 1.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Page 1 of 5